Remote Thread Injection

What It Is

What Changes Inside the Process

The process is shown before and after, and the pointer marks what changed.

What It Leaves Behind

Which Evidence Can See It

Each tile says whether that kind of evidence can see it, and what it shows.

• Memory

  Sees it

  A memory image holds the thread that starts in private memory no file backs, and the executable region it starts in, while the process runs.

• EDR Telemetry

  Sees it

  Defender XDR records CreateRemoteThreadApiCall in DeviceEvents, with the process that started the thread and the one it runs in.

• Disk

  Cannot see

  The target's file stays genuine, so a hash or signature check passes it. Only a dropped program that started the thread is on disk to find.

• Logs

  Partly

  Sysmon event 8 in Microsoft-Windows-Sysmon/Operational records the thread and where it starts, but only on machines running Sysmon.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Read where each thread starts, live with Windows.System.Threads or in a memory image with windows.threads' Win32StartAddress. Where Sysmon runs, event 8 with an empty StartModule records the same start.Threads
2. Find the region that holds the start with windows.vadinfo, which gives its type, the protection it was created with and its file. Then windows.malware.malfind flags private memory created executable and writable, or executable with a written page. A hit is a lead to dump, and a clean result does not clear it.Memory Regions
3. Find who holds the process open with the rights to write its memory and start threads. In memory, windows.handles lists that Process handle, and live, Handle lists it with every handle type and the granted access shown. Where Sysmon runs, event 10 records the open.Handles, Pipes and Mutexes
4. Tie its connections to it, live with Get-NetTCPConnection and in memory with windows.netscan. A connection its job never needs, such as the print spooler reaching the internet, points to code that is not its own.Network Connections
5. Sweep the whole process. Live, Windows.System.VAD lists executable memory no file backs. In a memory image, windows.malware.ldrmodules shows a private region that starts with an MZ header in no loader list. A hit is a lead to dump, once whoever runs the response agrees.Checking for Injected Code

Investigation Steps With Named Tools

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

• Which thread starts in memory no file backs, and which process started it?

  On a Running Machine

  • Windows.System.Threads (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. Lists each thread with its creation time, its start address and the file mapped there. A start with no file is the thread to follow.
  • CreateRemoteThreadApiCall (documentation, opens in a new tab)Logs and Records A Defender XDR action type, which is one kind of event Defender for Endpoint records in its DeviceEvents table. A DeviceEvents row naming the process that started the thread, InitiatingProcessFileName, and the one it runs in, FileName.
  • Defender for Endpoint live response (documentation, opens in a new tab)Live Machine Part of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk. processes Its processes command finds the process by PID or name. No built-in command lists threads, so reach them through a read-only library script started with run.

  In a Memory Image

  • windows.malware.suspicious_threads (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. Flags live threads that start in memory no file backs, and names the region each one starts in.

• What does the memory at the start hold?

  On a Running Machine

  • Windows.Memory.InjectedThreadEx (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. An exchange artifact, imported first, that reports threads whose start looks injected. It runs PowerShell, which some EDRs block, so begin with its Brief scan.

  In a Memory Image

  • windows.malware.malfind (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. malfind means find malware. Private regions created executable and writable, with their first bytes, so a program image shows as MZ (4D 5A).

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

Debugging, diagnostic, management and security tools start threads in other processes for good reasons, Microsoft notes, and SigmaHQ's rule leaves out a print vendor service and VMware Tools for spoolsv.exe. Judge the source, since a known, signed tool in its own folder is usual and a binary in Temp is not.

.NET and other just-in-time compilers make executable private memory in their own processes, which memory scans report.

Blind Spots

A remote thread record covers one way in. Memory checks look for the code whichever way it arrived, so pair the two.

A clean windows.malware.malfind result never clears a process, because it reads the protection each region was created with, not the one it has now. Pair it with windows.malware.suspicious_threads and thread records.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// Threads one process started in another (CreateRemoteThreadApiCall), initiators outside the system folders firstDeviceEvents| where Timestamp > ago(30d)| where ActionType == "CreateRemoteThreadApiCall" and ProcessId != InitiatingProcessId| extend FromSystemFolder = InitiatingProcessFolderPath startswith @"C:\Windows\System32\"    or InitiatingProcessFolderPath startswith @"C:\Windows\SysWOW64\"    or InitiatingProcessFolderPath startswith @"C:\Program Files"| summarize Threads = count(), Devices = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)    by InitiatingProcessFileName, InitiatingProcessFolderPath, FromSystemFolder, Target = FileName| order by FromSystemFolder asc, Devices asc, Threads asc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.malware.malfind (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. malfind means find malware. It lists private regions, and mapped ones not created as Execute, write copy, that were created executable and writable or executable with a written page, with their first bytes.
• windows.vadinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. vadinfo means virtual address descriptor information. It gives the flagged region's protection and its file, and injected code sits in a region that names no file.
• windows.dlllist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. dlllist means DLL list. It lists modules loaded the normal way, with their paths, so a DLL forced in through the loader shows here, often from an odd folder.
• windows.malware.ldrmodules (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. ldrmodules means loader modules. It sets every region that starts with an MZ header, private memory included, against the loader's three lists. A private region in no list and with no file is what ws-042's spooler shows, while the executable and resource files have ordinary reasons to miss a list.
• windows.vadyarascan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. It runs YARA rules over every region, to name what the injected code is.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• ASR: Block Office applications from injecting code into other processes (opens in a new tab) Block Office apps from injecting code into other processes, which Microsoft says has no known legitimate business purpose.
• Added LSA protection (opens in a new tab) Run lsass.exe as a protected process, so code that is not protected can neither inject into it nor read its memory. Check it in the Registry: LSA Protection (RunAsPPL)
• App Control for Business (opens in a new tab) Let only the code a policy trusts run, so an injector dropped in Temp never starts.
• Secure Boot, which turns AppInit_DLLs off (opens in a new tab) Keep Secure Boot on, so AppInit_DLLs stays off and a DLL listed there loads into nothing. Check it in the Registry: AppInit_DLLs
• No antivirus exclusions for temporary folders (opens in a new tab) Keep C:\Windows\Temp scanned. On ws-042 an exclusion for it came two minutes before updsvc64.exe landed there. Check it in the Registry: Microsoft Defender Exclusions

Related

Where It Matters Most

• svchost.exe A child from a copy whose service normally starts none, or executable memory no file backs.
• spoolsv.exe A thread another process started in it, or executable memory no file backs.
• lsass.exe A thread another process started in it, or executable memory no file backs.
• conhost.exe A console host under a core process can mean code running inside that process.

On ws-042, 12 Oct 2026

Open it in the tree: spoolsv.exeGenuine, code injected

Travels with

• Network Connections That Should Not Exist Code injected into a service often shows itself by talking out, as the spooler on ws-042 did one second after the thread started.
• Unsigned or Oddly Signed Modules A DLL forced in through the loader appears in the module list, often unsigned or from an odd folder.

Check It in the Registry

AppInit_DLLsAppCertDlls

Read with Active Directory

• Skeleton Key Code changed in lsass.exe's memory on a domain controller, which windows.malware.skeleton_key_check looks for.

Sources

• Microsoft Learn: Sysmon, event IDs 8 and 10 (opens in a new tab)
• Microsoft Learn: Process Security and Access Rights (opens in a new tab)
• Microsoft Security Blog: Uncovering cross-process injection with Windows Defender ATP (opens in a new tab)
• Microsoft Defender XDR: DeviceEvents table (opens in a new tab)
• Microsoft Learn: Live response in Defender for Endpoint (opens in a new tab)
• Microsoft Learn: ASR rule, block Office applications from injecting code (opens in a new tab)
• Elastic Security Labs: Hunting In Memory (opens in a new tab)
• SigmaHQ: Remote Thread Creation In Uncommon Target Image (opens in a new tab)
• Velociraptor: Windows.System.VAD (opens in a new tab)